MLflow CVE-2026-69146

Exploitation requires an active authenticated session on the target MLflow deployment (PR:L - low-privilege user account sufficient, no admin role needed). The mlflow.server.auth plugin must be enabled; default single-user or unauthenticated MLflow deployments are not affected. The attacker must know or enumerate a valid run_id belonging to another user's experiment - run IDs are UUIDs and not publicly listed, so some internal knowledge or API enumeration is required. Exploitation is limited to dataset lineage metadata tampering: the attacker cannot read confidential data (C:N), cannot delete runs or experiments, and cannot affect system availability (A:N). The vulnerability affects only the 3.13.0-3.14.x version range; installations outside this range are not affected.

The CVSS 6.5 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the real-world profile: the attack is network-accessible and low-complexity, but requires a valid authenticated session (PR:L), which meaningfully constrains the attacker pool to existing platform users. The integrity impact is high but domain-limited - the affected asset is dataset lineage metadata, not code, credentials, or underlying model weights, meaning the practical blast radius is ML experiment reproducibility and audit-trail trustworthiness rather than system compromise. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, with no confirmed public exploit code. Even a mid-sized data science organization in koszalin running a shared MLflow deployment should treat this as a timely-but-not-emergency patch, particularly if their threat model includes insider risk or shared-tenant ML workflows where lineage integrity is a compliance requirement. The CVSS vector is consistent with the description; no conflict between stated attack vector and exploitation mechanics was identified.

An authenticated MLflow user with access to any run in a shared deployment crafts a POST request to /api/2.0/mlflow/runs/log-inputs, supplying a run_id belonging to a colleague's experiment and attacker-controlled DatasetInput records. Because the auth middleware skips the validate_can_update_run check for this endpoint, the server accepts and persists the fabricated lineage records, corrupting the dataset provenance audit trail for that run. No public exploit code has been identified, but the attack requires only standard MLflow API knowledge and a valid session token.